Introduction The concept of “SQL Injection” Commands susceptible to injection attacks Some simple code Some security holes Preventing injection attacks

SQL Injects – Start wailing... Assuming you’ve got good security then the ability to make queries to an online database is difficult. A hacker would need to know the name and server location of the database file and some information about the fields used in a Members table in order to run a hack. This could take a long time to guess... Surprisingly, hacking passwords can be done using SQL injection routines on website forms.

SQL Injection This kind of attack is not a technological security hole in the Operating System or server software. It depends on the way that a website is developed. Some developers are unaware of this kind of attack and unknowingly develop web applications which open doors for hackers to inject SQL Queries / Commands into the system. To be able to perform SQL Injection hacking, all an attacker needs is a web browser and some guess work to find important table and field names.

SQL Injection Once an attacker realizes that a system is vulnerable to SQL Injection, they are able to inject SQL Query / Commands through an input form field. This is equivalent to handing the attacker the Query Browser, allowing him to send any SQL command like SELECT, INSERT, DELETE and DROP TABLE to the database!

Here’s a standard login form: <form method="post" action="login.php"> <input type="text" name="username"> <input type="password" name="password"> </form> And here’s a standard PHP SELECT SQL statement that is built from the user’s input to the form: "SELECT userid FROM Members WHERE username = '$username' AND password = '$password' ";

This would build the following SQL SELECT statement: Suppose that we gave "Joe" as a username and that the following string was provided as a password: anything' OR 'x'='x This would build the following SQL SELECT statement: "SELECT userid FROM Members WHERE username = 'Joe' AND password = 'anything' OR 'x'='x' "; Because the application is just constructing a string, the use of the single quotes has turned the WHERE into a two- component clause. The 'x'='x' part guarantees to be true regardless of what the first part contains. This will allow the attacker to bypass the login form without actually knowing a valid username / password combination!

Finding useful information Most members-only websites contain a link to retrieve a forgotten password If not carefully designed, then these forms are ripe for hacking! Mostly, these forms just consist of a single input box into which you type your email address Put this into a “retrieve login details” form and change 'field' to any fieldname (e.g. Email): x' OR field LIKE '%harry%

Finding useful information If the field does not exist, you will get an SQL error Otherwise you’ve found a field name! If the user does not exist, you will probably be told that your username is invalid Otherwise, you will get some kind of "We have emailed your user details to your email address" type message (usually giving the email address in the process) Therefore, by trial and error, you can find a valid user email address within the table! Now, what can we do with this information?..

Using gained information In SQL Server, Oracle and MySQL we can run multiple SQL statements by using SQL injections: Assuming we have discovered that the email field in the database is ‘Email’ and we have found a valid email address ‘harry.fowler@psychonaut.net’ then we can change their address in the table to ours: x'\; UPDATE Members SET Email = 'hacker@hacker.org' WHERE Email = 'harry.fowler@psychonaut.net'

Using gained information Now we can get hold of their password by simple entering our email address into the retrieve password form Scary huh? How about deleting tables? x' UNION DROP TABLE Users;-- This makes use of the SQL comment - - to close off the statement making it valid Surprisingly, MS Access cannot run multiple SQL commands in one go and so paradoxically is safer!

Preventing SQL Injections The best way to defend against SQL injection attacks is: to use “prepared statements” if possible to filter extensively any input that a user can give You should remove everything but the known good data and filter meta characters from the user input Remember to put maxlength attributes on your input boxes but don’t rely on them This helps to ensure that only what should be entered in the field will be submitted to the server

Background Reading SQL injection: http://en.wikipedia.org/wiki/Sql_injection https://www.owasp.org/index.php/SQL_Injec tion_Prevention_Cheat_Sheet Prepared statements: http://dev.mysql.com/doc/refman/5.0/en/sql- syntax-prepared-statements.html http://en.wikipedia.org/wiki/Prepared_statement